djvu | 14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e

Analysis

max time kernel
141s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
03/07/2024, 11:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe
Size 691KB
Sample240703-n2vl7asare
SHA256 14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e
MD5 94801476bc08359be42f9c749cdf3637
SHA1 f8a17073a45faf11d65fdd5aad601dcc437d5336
SHA512 5d802570d6a327c8cb181fce7ec15fc7b02729ac01e8893eed8d534bf1eca3261af0d88295daccc2cc06571de6c1aab8ac9e593a30ec3c212201ce61f05a6f7c
SSDEEP 12288:NyxkmO01+6w9wdlbS/o0rTCHJJ/KnE2ePt7cN3q6iynhXQpAwMj7b1vr:AamO0Mtwd5SwKCHJNeEPPt7cNY7AwM1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://cajgtus.com/test2/get.php

Attributes

extension
.waqa
offline_id
Lc3VTezPWbMhuVAQFzJUdeA68PwI7UDpc5aKHYt1
payload_url
http://defgyma.com/dl/build2.exe

http://cajgtus.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/abe121434ad837dd5bdd03878a14485820240531135509/34284d Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0875PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 15 IoCs

resource	yara_rule
behavioral2/memory/3108-2-0x0000000004650000-0x000000000476B000-memory.dmp	family_djvu
behavioral2/memory/4920-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4920-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4920-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4920-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4920-21-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4112-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4112-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4112-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4112-31-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4112-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4112-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4112-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4112-38-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4112-39-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2308	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-423582142-4191893794-1888535462-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1ee24b12-2df1-40e3-89f9-9c51b1aaaa01\\14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe\" --AutoStart"	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.2ip.ua
2	api.2ip.ua
6	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3108 set thread context of 4920	3108	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	80
PID 2328 set thread context of 4112	2328	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4920	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe
4920	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe
4112	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe
4112	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 4920	3108	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	80
PID 3108 wrote to memory of 4920	3108	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	80
PID 3108 wrote to memory of 4920	3108	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	80
PID 3108 wrote to memory of 4920	3108	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	80
PID 3108 wrote to memory of 4920	3108	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	80
PID 3108 wrote to memory of 4920	3108	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	80
PID 3108 wrote to memory of 4920	3108	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	80
PID 3108 wrote to memory of 4920	3108	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	80
PID 3108 wrote to memory of 4920	3108	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	80
PID 3108 wrote to memory of 4920	3108	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	80
PID 4920 wrote to memory of 2308	4920	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	82
PID 4920 wrote to memory of 2308	4920	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	82
PID 4920 wrote to memory of 2308	4920	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	82
PID 4920 wrote to memory of 2328	4920	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	83
PID 4920 wrote to memory of 2328	4920	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	83
PID 4920 wrote to memory of 2328	4920	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	83
PID 2328 wrote to memory of 4112	2328	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	86
PID 2328 wrote to memory of 4112	2328	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	86
PID 2328 wrote to memory of 4112	2328	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	86
PID 2328 wrote to memory of 4112	2328	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	86
PID 2328 wrote to memory of 4112	2328	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	86
PID 2328 wrote to memory of 4112	2328	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	86
PID 2328 wrote to memory of 4112	2328	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	86
PID 2328 wrote to memory of 4112	2328	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	86
PID 2328 wrote to memory of 4112	2328	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	86
PID 2328 wrote to memory of 4112	2328	14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe	86

C:\Users\Admin\AppData\Local\Temp\14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe
"C:\Users\Admin\AppData\Local\Temp\14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe
  "C:\Users\Admin\AppData\Local\Temp\14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\1ee24b12-2df1-40e3-89f9-9c51b1aaaa01" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2308
- - C:\Users\Admin\AppData\Local\Temp\14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe
    "C:\Users\Admin\AppData\Local\Temp\14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe
      "C:\Users\Admin\AppData\Local\Temp\14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed
MD5 2365869258df7a66a2121b802ca4afd9
SHA1 73acc30a2edeb9d6830de559bb8a74f35168135d
SHA512 795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4
MD5 SHA1 SHA512

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 436B
SHA256 5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f
MD5 1bfe0a81db078ea084ff82fe545176fe
SHA1 50b116f578bd272922fa8eae94f7b02fd3b88384
SHA512 37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d
MD5 SHA1 SHA512

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 7212e6b35e7be4ac24ed15e9aabb309b366be7f4dfc1eab17bbc98c90ec7912d
MD5 d1b3c7e51e8db1d6ab3039cf0bea3928
SHA1 fd1e1de77799571e9c8955d0e15acb03e2dd3125
SHA512 000e32eac0a813a136e84cfec692f45f253fd79ea2265d90b09eb57a4720b0cafeac8c435f0e70e6faceb4c8446da7b3845b28ce003a615d969e0f81e83ea8a8
MD5 SHA1 SHA512

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 babdf510e3dc571b873c0d0eda5365af8af4d7c78a9691fdd1a72aa1da3c4fc7
MD5 2f937f1a0533ac9b6a4043d2c1a37c1c
SHA1 9b521202dc977b72be75871ba3c39374ed2fd39c
SHA512 3cc9d8925bf4dd1486c364a363c7b3c1ae3e3fa56a960f97849c836de37f4193862b9cf3f8ee740eae59512385b5ac9759173b5b647d6dd49028b1fb4e9a9a6a
MD5 SHA1 SHA512

Submit Download

14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe

Path C:\Users\Admin\AppData\Local\1ee24b12-2df1-40e3-89f9-9c51b1aaaa01\14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e.exe
Size 691KB
SHA256 14e132aad0c786082367c4af683faa76dbb45356965b0f1093753cdec3a2b08e
MD5 94801476bc08359be42f9c749cdf3637
SHA1 f8a17073a45faf11d65fdd5aad601dcc437d5336
SHA512 5d802570d6a327c8cb181fce7ec15fc7b02729ac01e8893eed8d534bf1eca3261af0d88295daccc2cc06571de6c1aab8ac9e593a30ec3c212201ce61f05a6f7c
SSDEEP 12288:NyxkmO01+6w9wdlbS/o0rTCHJJ/KnE2ePt7cN3q6iynhXQpAwMj7b1vr:AamO0Mtwd5SwKCHJNeEPPt7cNY7AwM1
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3108-1-0x00000000045B0000-0x0000000004644000-memory.dmp

Download

memory/3108-2-0x0000000004650000-0x000000000476B000-memory.dmp

Download

memory/4112-31-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4112-37-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4112-39-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4112-38-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4112-36-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4112-24-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4112-30-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4112-29-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4112-34-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4920-3-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4920-4-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4920-5-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4920-6-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4920-21-0x0000000000400000-0x0000000000537000-memory.dmp

Download